Skip to content

Add sensible defaults to StaxUtils's MAX_ELEMENT_COUNT and MAX_XML_CHARACTERS #3463

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
reta merged 3 commits into from
Sep 14, 2026
+6 −3
Merged

Add sensible defaults to StaxUtils's MAX_ELEMENT_COUNT and MAX_XML_CHARACTERS #3463

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4f3c30d
Add sensible defaults to StaxUtils's MAX_ELEMENT_COUNT and MAX_XML_CH…
reta Sep 13, 2026
6b71665
Apply suggestion from @reta
reta Sep 14, 2026
687790c
Apply suggestion from @reta
reta Sep 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,10 +147,10 @@ public final class StaxUtils {
getInteger(MAX_TEXT_LENGTH, 128 * 1024 * 1024); //128M - more than this should DEFINITELY use MTOM
private static final int MIN_TEXT_SEGMENT_VAL =
getInteger(MIN_TEXT_SEGMENT, 64); // Same default as woodstox
private static final long MAX_ELEMENT_COUNT_VAL =
getLong(MAX_ELEMENT_COUNT, Long.MAX_VALUE);
// The MAX_XML_CHARACTERS should be aligned with MAX_TEXT_LENGTH (maximum contiguous length of any character
Comment thread
coheigea marked this conversation as resolved.
// data segment)
private static final long MAX_XML_CHARS_VAL =
getLong(MAX_XML_CHARACTERS, Long.MAX_VALUE);
getLong(MAX_XML_CHARACTERS, 256 * 1024 * 1024); //256Mb, maximum length of input document, in characters
private static final int PARSER_POOL_SIZE_VAL =
getInteger("org.apache.cxf.staxutils.pool-size", 20);
private static final boolean ALLOW_INSECURE_PARSER_VAL;
Expand All @@ -161,6 +161,9 @@ public final class StaxUtils {
getInteger(MAX_ELEMENT_DEPTH, getInteger(INNER_ELEMENT_LEVEL_SYSTEM_PROP, 100));
private static final int MAX_CHILD_ELEMENTS_VAL =
getInteger(MAX_CHILD_ELEMENTS, getInteger(INNER_ELEMENT_COUNT_SYSTEM_PROP, 50000));
// The MAX_ELEMENT_COUNT should be aligned with MAX_CHILD_ELEMENTS
private static final long MAX_ELEMENT_COUNT_VAL =
getLong(MAX_ELEMENT_COUNT, Math.max(100L * MAX_CHILD_ELEMENTS_VAL, 50000L));

// Variables from Woodstox
private static final String P_MAX_ATTRIBUTES_PER_ELEMENT = "com.ctc.wstx.maxAttributesPerElement";
Expand Down
Loading